I'm trying to find the line number of the 0f05 syscall interrupt with no success.

I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the CPU (which make sense).

My goal is to follow the debugger to the kernel code but currently I don't know which function I need to put a break point on.

When I do "step into" on the syscall line it simply move to the next instruction like it is mov or something


  • what do you mean by "line number"?
    – Igor Skochinsky
    Oct 9, 2019 at 9:08
  • I assume the OP is trying to debug a user space process with WinDbg and wonders why stepping in "syscall" instruction does not lead him to the syscall handler code (in kernel mode), but instead it moves to the next instruction after syscall. Am I right? Oct 9, 2019 at 11:51
  • You guys are wrong. I'm debugging a VM with KD and can debug the kernel without any problem if I put the breakpoint on a kernel function, for example. For some reason you can't step into kernel code from the syscall instruction. Oct 9, 2019 at 13:33
  • No need to get confrontational, Anton was just making a guess from the information you provided. You can edit the question to clarify your issue (and maybe fix the title since it's not actually about interrupts)
    – Igor Skochinsky
    Oct 10, 2019 at 9:17

1 Answer 1


The AMD64 syscall instruction is not an interrupt (neither software nor hardware). The destination of it is stored not in IDT but in a Machine-specific register (MSR) called IA32_LSTAR.

  • Thanks, this is correct. I later found a page who explained just that. I would add that you can get the relevant information with the following command: rdmsr 0xC0000082 Oct 10, 2019 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.